How to Manually Update a WordPress Plugin: 3 Safe Ways

When Automatic Updates Fail, You Need a Backup Plan

Knowing how to manually update a WordPress plugin is one of the most practical skills a site owner can have, especially when an automatic update fails and your site is left vulnerable. While the WordPress ecosystem has evolved to make maintenance easier, the complexity of modern web environments means that the “one-click” solution is not always a guarantee. Understanding the underlying file structure and the various methods of deployment ensures that you are never at the mercy of a spinning loading icon or a cryptic error message.

Here is a quick overview of the three main methods we will cover in detail:

WordPress Dashboard (ZIP upload) – Download the plugin ZIP, go to Plugins > Add New > Upload Plugin, and select “Replace current with uploaded.” This is the most common and user-friendly approach for most site administrators.
FTP/SFTP – Connect directly to your server’s file system, navigate to the /wp-content/plugins/ directory, rename the old plugin folder to create a temporary backup, and upload the new version. This is the gold standard when the WordPress dashboard is inaccessible due to a fatal error.
WP-CLI – Run the command wp plugin update plugin-slug from your terminal. This is the preferred method for developers and power users who have SSH access and need to manage updates across multiple environments quickly.

Always back up your site before using any of these methods.

Automatic updates are convenient, but they are not foolproof. Server timeouts, file permission errors, and plugins that live outside the WordPress.org repository can all cause the update process to break silently, leaving your site running outdated code. With over 60,000 plugins available and WordPress powering more than 40% of the web, the stakes are real. A 2019 Sucuri report found that 52% of hacked WordPress sites were simply running outdated plugins, themes, or core files. This statistic highlights a critical reality: security is a proactive process, not a passive one.

Manual updates put you in control. They allow you to verify the integrity of the files, check for compatibility issues in a controlled environment, and ensure that your site’s functionality remains intact throughout the process.

I’m Kevin Gallagher, founder of wpOncall, and over fifteen years of building and managing WordPress sites I’ve personally handled hundreds of manual plugin updates, including urgent security patches where knowing how to manually update a WordPress plugin was the only option. In the sections below, I’ll walk you through every method clearly, so you can handle this confidently no matter your technical level.

Quick how to manually update a wordpress plugin definitions:

Why You Need to Know How to Manually Update a WordPress Plugin

As of May 2026, WordPress remains the world’s most popular content management system, but its greatest strength—its massive ecosystem of third-party plugins—is also its biggest maintenance challenge. While the “Enable auto-updates” link in your dashboard is a useful convenience, it is not a set-it-and-forget-it solution. Relying solely on automation can lead to a false sense of security, as many factors can interfere with the background processes that keep your site current.

There are several technical and logistical reasons why you should understand how to manually update a wordpress plugin:

Server timeouts and PHP limits: Many large plugins, such as ecommerce suites, backup tools, and visual builders, can exceed 20MB or even 50MB in size. If your server has restrictive PHP settings—such as a low memory_limit, upload_max_filesize, post_max_size, or a short max_execution_time—the automatic updater may stop halfway through. This often results in a “Briefly unavailable for scheduled maintenance” message that doesn’t go away, or worse, a partial file replacement that breaks the plugin’s logic.
Premium plugin architectures: Premium plugins purchased from third-party developers often do not live in the official WordPress.org repository. These plugins rely on custom update servers and API keys. If the vendor’s license API fails, the update server is unreachable, or your license key expires, the in-dashboard update button may disappear or fail. In those cases, you need to download the ZIP package manually from the developer portal and install it yourself to ensure you have the latest security patches.
File permission conflicts: Some hosting environments, particularly those with strict security configurations, prevent WordPress from writing directly to the /wp-content/plugins/ directory. This can trigger errors such as “Could not create directory” or repeated prompts for FTP credentials. A manual update via SFTP lets you work around these server-level limitations cleanly by using your direct system credentials.
Version control and testing: Sometimes the latest release is not the right release for your specific setup. A major plugin update may introduce breaking changes, require a newer PHP version, or change how a feature works. Manual updates let you choose the exact version you want to install and test first. This is especially useful for WordPress Plugin Version Management.
Security response time: When a critical vulnerability is disclosed, waiting for an automatic update cycle (which might only run once every 24 hours) is not always ideal. If a patched version is available on the developer’s site or GitHub, a manual update gives you a direct way to close the security gap immediately.
Dashboard access problems: If a plugin update causes fatal errors in wp-admin, you may lose normal access to the site. This is the dreaded “White Screen of Death.” Knowing how to update, replace, or restore plugin files through FTP or the command line can be the difference between a quick recovery and hours of downtime.

Keeping your site current is not just a maintenance task; it is a fundamental pillar of WordPress security. With 52% of hacked sites traced back to outdated components, a prompt Wp Plugin Update is often your first line of defense against known vulnerabilities like Cross-Site Scripting (XSS) or SQL Injection.

There is also a practical business reason to learn this process. Outdated plugins can break forms, checkouts, memberships, booking systems, and other core features without much warning. Even if the site still loads, a broken integration can quietly cost you leads or revenue. Manual updates give you another recovery path when convenience tools fail, ensuring that your business operations remain uninterrupted.

Critical Preparation: Backups and Staging Environments

Before you touch a single file, you must have a safety net. We have seen too many site owners try to “quick-fix” a plugin only to end up with a White Screen of Death and no way to revert. Preparation is the difference between a 5-minute update and a 5-hour recovery mission.

The Gold Standard: Staging vs. Live

For high-traffic sites or e-commerce stores, you should never update a major plugin directly on your live site. Instead, use a staging environment—a private clone of your website where you can test the update safely. This allows you to verify that the new plugin version doesn’t conflict with your theme or other active plugins.

Feature	Staging Update	Live Update
Risk Level	Zero	High
User Impact	None	Potential Downtime
Testing	Full Visual Regression	Limited
Recovery	Delete Staging Site	Restore Full Backup

Step 1: Create a Full Site Backup

At wpOncall, we recommend a “belt and suspenders” approach to WordPress Update Management. Use a plugin like UpdraftPlus or Duplicator to create a full archive of your database and your files. If you are using a managed host, use their dashboard to take a manual snapshot. Ensure you have a copy of the backup stored off-site (e.g., Dropbox, Google Drive, or your local computer) so you can access it even if the server goes down.

Step 2: Deactivate Caching

Caching plugins (like WP Rocket or W3 Total Cache) and server-level CDNs can sometimes serve “ghost” versions of your old plugin files even after an update. This can lead to confusing errors where the site appears broken because it is trying to load old JavaScript with new PHP files. Turn these off temporarily to ensure you are seeing the real-time results of your manual update.

Step 3: Check Compatibility

Read the plugin’s changelog. If the update jumps from version 2.0 to 3.0, it’s a “major” release that likely includes significant database changes. Check if it requires a newer version of PHP—you can find more on this in our guide on WordPress Php Update Plugin. You should also check the WordPress Developer Resources for any known issues with the specific version you are installing.

Three Proven Methods for Manual Plugin Updates

Depending on your comfort level with technology and your access to server credentials, there are three reliable ways to complete a manual plugin update. Each has its own advantages depending on the state of your website.

How to Manually Update a WordPress Plugin via the Dashboard

This is the most user-friendly method and works for most scenarios. Since WordPress 5.5, the core software includes a built-in replacement workflow that handles manual ZIP uploads much more gracefully than older versions did, which used to require you to delete the plugin first.

Download the plugin ZIP: Go to the WordPress.org Plugin Directory or your premium developer account and download the latest ZIP file.
- Tip: If you are using Safari on a Mac, it may automatically unzip the download. WordPress needs the ZIP archive, not the extracted folder. If Safari expands it automatically, right-click the folder and select “Compress” to turn it back into a ZIP before uploading.
Navigate to the plugin installer: In your WordPress admin dashboard, go to Plugins > Add New.
Choose Upload Plugin: Click the Upload Plugin button at the top of the screen.
Select the ZIP file: Click Choose File, select the downloaded ZIP from your computer, and then click Install Now.
Replace the existing version: WordPress will detect that the plugin is already installed. It will display a comparison screen showing the “Current” version and the “Uploaded” version. Review these numbers carefully, then click Replace current with uploaded.
Confirm activation status: In most cases, an already active plugin stays active after replacement. Still, verify that the plugin remains active by checking the list in Plugins > Installed Plugins.
Test the affected features: Open the pages or functions the plugin controls and make sure everything works as expected. If it’s a contact form plugin, send a test message. If it’s an SEO plugin, check your meta tags.

Using FTP/SFTP to Manually Update a WordPress Plugin

If your dashboard is inaccessible, your upload size limit is too small, or WordPress cannot write to the plugins directory due to permission errors, FTP is the fallback method. Whenever possible, use SFTP (Secure File Transfer Protocol) instead of plain FTP because it encrypts the connection, protecting your server credentials.

Gather your credentials: You will need your host address, username, password, and port (usually 22 for SFTP) from your hosting control panel.
Connect with an FTP client: Open a client such as FileZilla or Cyberduck and connect to the server.
Go to the plugins directory: Navigate to the root of your WordPress installation, then go to /wp-content/plugins/.
Identify the plugin folder: Find the existing plugin folder you wish to update (e.g., woocommerce or elementor).
Rename the old folder for safety: Right-click the folder and rename it to something like plugin-name-old. This is a critical safety step; it gives you a fast rollback path if the new version has a problem. Simply deleting the old folder and renaming the backup back to the original name takes seconds.
Prepare the new plugin files locally: Unzip the newly downloaded plugin archive on your computer. You should see a folder containing the plugin’s PHP files and assets.
Upload the new folder: Drag the unzipped folder from your computer into the /wp-content/plugins/ directory on the server. Ensure the folder name matches the original exactly.
Check the site and dashboard: Log in to WordPress and verify the plugin appears correctly and is active. WordPress may automatically deactivate the plugin if it detects the folder name changed, so you may need to click “Activate.”
Delete the backup folder after testing: Once you are 100% certain the update worked and your site is stable, remove the -old folder to keep your server clean.

Updating Plugins via WP-CLI for Advanced Users

For developers, agencies, and anyone managing multiple WordPress sites, WP-CLI (WordPress Command Line Interface) is often the fastest and most dependable option. Because it runs from the command line, it avoids many of the browser-based limitations tied to PHP execution time and web requests. You can find the full documentation for these commands at the WP-CLI Plugin Update Page.

Access your server over SSH: Open a terminal session and connect to your server.
Move to the WordPress install directory: Use the cd command to change into the directory where WordPress is installed (e.g., cd /var/www/html).
List available plugin updates: Run wp plugin list --update=available to see exactly what needs attention.
Update a specific plugin: Use the plugin slug, which is usually the folder name.
- Example: wp plugin update contact-form-7
Update all plugins if appropriate: If you are confident in your environment, run wp plugin update --all.
Verify the installed version: Run wp plugin list and confirm the expected version number is now active.
Test site functionality: Even if the command succeeds, you should still test the site in a browser to ensure no visual or functional regressions occurred.

WP-CLI is powerful because it is scriptable and efficient. It is ideal for maintenance workflows, staging deployments, and managing multiple sites at scale. It is also a strong option when you need to apply a Plugin Updates WordPress routine quickly across several environments without clicking through dozens of menus.

Post-Update Procedures and Troubleshooting

After the files are replaced, the job is not finished. A successful upload does not always mean a successful update. You should confirm that the plugin is loading properly, that the front end still works, and that no hidden errors were introduced. This phase is where most site owners fail by assuming everything is fine just because the dashboard says “Update Successful.”

Clear all caches: Purge your caching plugin (WP Rocket, LiteSpeed, etc.), server-level cache (Varnish, Nginx FastCGI), CDN cache (Cloudflare), and your local browser cache. Many apparent plugin issues after an update are really old CSS or JavaScript files being served from cache while the server is running new PHP code.
Run visual checks in an incognito window: Open a private browsing session to bypass any logged-in user cookies and review your homepage, contact page, blog, and any plugin-specific pages such as checkout, course, booking, or membership screens.
Test the plugin’s core function: If you updated a forms plugin, submit a form. If you updated an ecommerce plugin, test add-to-cart and checkout. If you updated a SEO or caching plugin, verify that settings and outputs still appear correctly in the page source.
Look for the .maintenance file: If your site is stuck showing “Briefly unavailable for scheduled maintenance,” connect through FTP and check the WordPress root directory for a file named .maintenance. Delete it to bring the site back online immediately.
Check file permissions: If the plugin does not appear to load or update correctly, make sure directories are typically set to 755 and files to 644. Incorrect permissions can prevent the plugin from executing its code.
Review error logs: If the site shows a white screen, fatal error, or warning messages, check your hosting error logs. You can also enable WordPress debugging by editing your wp-config.php file. For more details on this, refer to the WordPress Debugging Guide.
Watch for JavaScript conflicts: Some updates change scripts, dependencies, or initialization order. If buttons stop working or layouts break, right-click the page, select “Inspect,” and check the “Console” tab for JavaScript errors.
Confirm the version number: Go to the Plugins screen and verify that the expected plugin version is now installed and active.
Rollback if needed: If the new version creates a conflict that you cannot solve quickly, revert to the previous version. You can use the WordPress Plugin Rollback How To Revert Plugin Update In WordPress Safely method. If you used the FTP rename workflow, delete the new plugin folder and rename the -old folder back to its original name.

If you regularly run into update failures, it usually points to a bigger process problem, such as missing staging workflows, outdated PHP versions, poor hosting configuration, or too many untested plugin interactions. In that case, it helps to build a more structured maintenance routine and keep recent backups readily available. For more help recovering from bad updates, see WordPress Plugin Update Gone Wrong Heres How To Roll It Back.

Frequently Asked Questions about Manual Plugin Updates

Will I lose my settings if I update a plugin manually?

In 99% of cases, no. WordPress separates plugin files from plugin data. Your settings, configurations, and content are stored in the WordPress database, while the manual update only replaces the files in the /wp-content/plugins/ folder. As long as you don’t use a “Delete Data on Uninstall” feature (which is rare during a simple file replacement), your settings will remain intact. For more peace of mind, check out Mastering WordPress Plugin Rollbacks Revert Updates With Ease 2.

What is the correct order for updating WordPress components?

The safest order is:

Plugins (one by one, testing as you go).
Themes.
WordPress Core. Updating plugins first ensures that they are compatible with the new version of the WordPress core before you make the big jump. You can use tools like Wp Updates Notifier to keep track of these.

How do I handle premium plugins that are not in the WordPress repository?

You must log in to the developer’s “Customer Area” or “Account” page. Download the latest ZIP file directly from them. Since these plugins don’t have a direct line to the WordPress.org API, manual updates via the Dashboard ZIP method are the standard way to keep them current. If you find the constant update emails annoying, here is How To Stop WordPress Plugin Update Emails.

What if the manual update still fails?

If a manual update fails, it is usually due to a conflict with another plugin or your theme. Deactivate all other plugins and switch to a default theme like Twenty Twenty-Four. If the update works then, you know there is a conflict. If it still fails, check your server’s PHP version; many modern plugins require PHP 7.4 or 8.x to function correctly.

Can I update plugins on a WordPress Multisite network manually?

Yes, but you must do it from the Network Admin dashboard. When you update a plugin on a multisite network, it updates the files for the entire network. Individual site admins cannot update plugins; only the Super Admin has this capability. The FTP and WP-CLI methods work exactly the same for multisite as they do for single-site installations.

Conclusion

Mastering how to manually update a wordpress plugin is like knowing how to change a tire. You might not need to do it every day, but when you’re stuck on the side of the “digital highway” with a failed update, it’s the only skill that matters. It transforms you from a passive user into a capable site administrator who can handle technical hurdles with confidence.

By following the steps above—preparing with backups, choosing the right method (Dashboard, FTP, or CLI), and testing thoroughly—you can ensure your site stays fast, functional, and most importantly, secure. Remember that maintenance is an ongoing commitment. A secure site is one that is monitored, updated, and backed up regularly.

If the thought of managing these technical details feels overwhelming, or if you’ve ever spent a whole weekend trying to fix a broken update, we are here to help. At wpOncall, we specialize in taking the stress out of WordPress management. We provide daily updates, secure backups, and unlimited support to keep your site running perfectly while you focus on your business. We handle the technical heavy lifting so you can focus on growth.

Learn more about our WordPress maintenance and support services and let us handle the updates for you!